Spam / Phishing - Graymail to the Microsoft Outlook Junk Folder

This article contains information on creating Microsoft 365 transport rules to direct emails flagged by Mimecast as graymail to the Outlook Junk Folder, by setting specific headers and Spam Confidence Levels (SCL). 

Establishing a transport rule is essential for effectively managing emails identified as graymail by Mimecast. Without this rule in place, you may find these communications cluttering your Inbox, leading to decreased productivity and potential oversight of important messages.

Considerations

• The Spam Confidence Level (SCL) determines how Microsoft 365 treats the email. Setting the SCL to 6 tells the system to classify the email as spam, automatically placing it in the Junk Folder. 
  

  For more information on SCL, see Microsoft's article.

• The X-Mimecast-Bulk-Signature: yes header added by Mimecast identifies bulk or graymail, which triggers this rule.

To learn more about how to have this header added to all graymail, please refer to the Graymail Detection Action section in the article Spam / Phishing - Spam Scanning. Choosing Tag Headers as Graymail in your Spam Scanning Definition for Graymail ensures that the header X-Mimecast-Bulk-Signature is added to all graymail detections.

Transport Rule Configuration

You can create a transport rule in Microsoft 365 that directs emails with Mimecast's graymail header to the Outlook Junk Folder, by using the following steps:

1. Access Exchange Admin Center:

• • Log in to the Exchange Admin Center.
  • Navigate to Mail flow | Rules,

2. Define the rule:

• • Click on + Add a Rule, then click on Create a new rule.
  • Name the rule, e.g: "Move Graymail to Junk".
  • Conditions:
    • Select the dropdown underneath Apply the rule if, and choose The message headers...
    • Select the dropdown on the right, and choose matches these text patterns.
    • Select Enter text and add specify header name: "X-Mimecast-Bulk-Signature".
    • Select Enter words and add specify words or phrases: "Yes".
    • Click Add and Save.

3. Set the Action:

• • Select the dropdown underneath Do the following and choose Modify the message properties.
  • Select the dropdown on the right and choose set the spam confidence level (SCL).
  • Set the SCL to 6 to ensure the email will be treated as spam and placed in the Junk Folder. 

Please note that a value of 6 is based on the default Microsoft configuration. If you have changed the default configuration, then you should use the value you have configured.

• • Set the required rule settings:
    • If you want to activate the rule from a specific date, you can check Activate this rule on, and it will select today's date and time.
    • Regardless of if a date and time was selected, click on Next.

 

4. Save the rule:

• • Review the rule, ensuring it applies to inbound messages, and click on Finish.
     

5. Turn on the rule: 

• • If the rule was not enabled on the Rules page, you can enable it as follows:
    • Click on the Rule to open the side view.
    • Turn on the toggle next to Disabled to enable the rule.

      You can move the rule up in priority if it's not taking effect.

 

Marking a Message as Not Junk

Microsoft Outlook End Users can mark an item in their Junk folder as Not Junk, which moves the message to the Inbox. See Microsoft's article on adding recipients to the Safe Senders List in Outlook, resulting in future messages from safe senders being received in the Inbox.

See Also...

• Mimecast for Outlook - Graymail Rule